Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Execution Vectors
SECRET//NOFORN
Stash Repository: Execution Vectors Library
Interface Description:
Library Conventions:
Naming convention of classes in the Execution Vectors library:
- Prefix EVExecution Vector (Execution Vector)
- Indication that the class is for Infection (Infecting a file, path, etc), or Execution (code to be implemented post execution)
- Medium of delivery to target (file, removable media, network share, etc)
- Infection label (link file, word document, pdf, trojan, etc)
- _ Crypt specifying tool/technique, abbreviated to 2-3 letters (EZC = EZCHEESE, Rap = Raptor, etc)
Example:
EVIRemovableMediaLink_EZC
EV = Execution Vector
I = Infection class
Removable Media = Execution gained by infecting removable media
Link = Link File Exploit
_EZC = EZCHEESE Exploit
Execution Vector List:
Removable Media Link File Exploitation (EZCHEESE) - Class Name: EVRemovableMediaLink_EZC
- Network Share Link File Exploitation (DRIFTINGSHADOWS) - Class Name: EVNetworkShareLink_DS
Execution Vector Library Error Code Descriptions:
typedef int EVRET; //Return Code Type For Execution Vector Library
Error codes 30 through 50 and -30 through -50 are reserved for per class error codes.
Error codes >= 0 are successful. The return code will work with the SUCCESS() and FAILED() macros.
//General Error codes for Execution Vectors Library (does not include per class error codes)
#define EVRET_FILE_ALREADY_EXISTS 10 //File Already Exists
#define EVRET_SUCCESS 0 //Generic success
#define EVRET_UNKNOWN -1 //Unknown Failure : Unimplemented or undefined
#define EVRET_INVALID_ARGS -2 //Invalid Arguments
#define EVRET_BAD_PATH -3 //Path not valid
#define EVRET_INSUFFICIENT_MEM -4 //Out of memory
Code Sample Using The Library Interface:
Removable Media Link (EZCHEESE)
#define EVRET_RAN_OUT_OF_LINK_NAMES 30 //Success, not all link files were created
#define EVRET_INVALID_DRIVE_TYPE -30 //Invalid Drive Type
#define EVRET_INVALID_PAYLOAD -31 //Invalid payload buffer or invalid payload size
#define EVRET_FAILED_PAYLOAD_WRITE -32 //Failed to write payload to disk
#define EVRET_INVALID_PAYLOAD_PATH -33 //Path Has Space In Name
#define EVRET_FAILED_LINK_CREATE -34 //Failed to generate link files - could not generate path strings
#define EVRET_NO_LINK_FILE_NAME -35 //No link file names provided
#define EVRET_PATH_TOO_LONG -36 //The path to the dll was too long
PSP/OS Issues:
None identified
SECRET//NOFORN